@cloudbase/manager-node 4.11.0-alpha.6 → 4.11.0-alpha.8

package/lib/environment.js

@@ -8,6 +8,7 @@ const agent_1 = require("./agent");
 const storage_1 = require("./storage");
 const env_1 = require("./env");
 const common_1 = require("./common");
+const log_1 = require("./log");
 const error_1 = require("./error");
 const constant_1 = require("./constant");
 const utils_1 = require("./utils");
@@ -17,6 +18,7 @@ const access_1 = require("./access");
 const user_1 = require("./user");
 const cloudBaseRun_1 = require("./cloudBaseRun");
 const mysql_1 = require("./mysql");
+const permission_1 = require("./permission");
 class Environment {
     constructor(context, envId) {
         this.inited = false;
@@ -31,12 +33,14 @@ class Environment {
         this.databaseService = new database_1.DatabaseService(this);
         this.storageService = new storage_1.StorageService(this);
         this.envService = new env_1.EnvService(this);
+        this.logService = new log_1.LogService(this);
         this.hostingService = new hosting_1.HostingService(this);
         this.thirdService = new third_1.ThirdService(this);
         this.accessService = new access_1.AccessService(this);
         this.userService = new user_1.UserService(this);
         this.cloudBaseRunService = new cloudBaseRun_1.CloudBaseRunService(this);
         this.mysqlService = new mysql_1.MysqlService(this);
+        this.permissionService = new permission_1.PermissionService(this);
     }
     async lazyInit() {
         if (!this.inited) {
@@ -78,6 +82,9 @@ class Environment {
     getEnvService() {
         return this.envService;
     }
+    getLogService() {
+        return this.logService;
+    }
     getHostingService() {
         return this.hostingService;
     }
@@ -96,6 +103,9 @@ class Environment {
     getMysqlService() {
         return this.mysqlService;
     }
+    getPermissionService() {
+        return this.permissionService;
+    }
     getCommonService(serviceType = 'tcb', serviceVersion) {
         return new common_1.CommonService(this, serviceType, serviceVersion);
     }

package/lib/function/index.js

@@ -924,6 +924,56 @@ class FunctionService {
             });
         }
     }
+    /**
+     * 更新函数代码和配置（带进度信息）
+     * 支持同时更新代码和配置，按顺序执行：等待就绪 → 更新代码 → 等待就绪 → 更新配置 → 等待就绪
+     * @param options 更新选项
+     * @returns 更新结果，包含耗时信息
+     */
+    async updateFunctionWithProgress(options) {
+        const { name, code, config } = options;
+        const startTime = Date.now();
+        const details = [];
+        // codeSecret 在不同阶段可能不同：
+        // - 更新代码前/后：用旧的 codeSecret（函数此时还是旧密钥）
+        // - 更新配置后：如果 config 中带了新 codeSecret，函数密钥已变更，需用新值
+        const oldCodeSecret = (code === null || code === void 0 ? void 0 : code.codeSecret) || (config === null || config === void 0 ? void 0 : config.codeSecret);
+        const newCodeSecret = (config === null || config === void 0 ? void 0 : config.codeSecret) || (code === null || code === void 0 ? void 0 : code.codeSecret);
+        // 1. 等待函数状态就绪（此时函数还是旧密钥）
+        details.push('等待函数状态就绪...');
+        await this.waitFunctionActive(name, oldCodeSecret);
+        details.push(`函数状态就绪 (${Math.round((Date.now() - startTime) / 1000)}s)`);
+        // 2. 更新代码
+        if (code && (code.functionPath || code.base64Code)) {
+            details.push('开始更新代码...');
+            await this.updateFunctionCode(Object.assign({ func: {
+                    name,
+                    // 从 config 取公共字段
+                    runtime: config === null || config === void 0 ? void 0 : config.runtime,
+                    installDependency: config === null || config === void 0 ? void 0 : config.installDependency,
+                    ignore: config === null || config === void 0 ? void 0 : config.ignore,
+                    codeSecret: oldCodeSecret
+                } }, code));
+            details.push(`代码更新完成 (${Math.round((Date.now() - startTime) / 1000)}s)`);
+            // 等待函数再次就绪（代码更新不改变 codeSecret，仍用旧值）
+            await this.waitFunctionActive(name, oldCodeSecret);
+        }
+        // 3. 更新配置
+        if (config) {
+            details.push('开始更新配置...');
+            await this.updateFunctionConfig(Object.assign({ name }, config));
+            details.push(`配置更新完成 (${Math.round((Date.now() - startTime) / 1000)}s)`);
+            // 等待函数再次就绪（配置更新后 codeSecret 可能已变更，用新值）
+            await this.waitFunctionActive(name, newCodeSecret);
+        }
+        const elapsedTime = Date.now() - startTime;
+        details.push(`全部更新完成 (${Math.round(elapsedTime / 1000)}s)`);
+        return {
+            elapsedTime,
+            message: `更新成功，总耗时 ${Math.round(elapsedTime / 1000)}s`,
+            details
+        };
+    }
     /**
      * 调用云函数
      * @param {string} name 云函数名称
@@ -1471,7 +1521,13 @@ class FunctionService {
             }
         });
         return new Promise((resolve, reject) => {
+            // 添加超时保护
+            const timeout = setTimeout(() => {
+                packer.clean();
+                reject(new error_1.CloudBaseError(`[${func.name}] COS 上传超时（60秒）`));
+            }, 60000);
             cos.sliceUploadFile(uploadParams, async (err, data) => {
+                clearTimeout(timeout);
                 // 清理临时文件
                 await packer.clean();
                 if (err) {
@@ -1550,29 +1606,6 @@ class FunctionService {
             UnixTimestamp
         };
     }
-    async createAccessPath(name, path) {
-        const access = this.environment.getAccessService();
-        try {
-            await access.createAccess({
-                name,
-                path
-            });
-        }
-        catch (e) {
-            // 当 Path 存在时，校验 Path 绑定的函数是不是当前函数
-            if (e.code === 'InvalidParameter.APICreated') {
-                const { APISet } = await access.getAccessList({
-                    name
-                });
-                if ((APISet === null || APISet === void 0 ? void 0 : APISet[0].Name) !== name || (APISet === null || APISet === void 0 ? void 0 : APISet[0].Type) !== 1) {
-                    throw e;
-                }
-            }
-            else {
-                throw e;
-            }
-        }
-    }
     async getCodeParams(options, installDependency) {
         const { func, functionPath, functionRootPath, base64Code, deployMode } = options;
         // 直接传入 base64Code 的情况，校验大小
@@ -1625,6 +1658,29 @@ class FunctionService {
             TempCosObjectName: `/${legacyResult.Key}`
         };
     }
+    async createAccessPath(name, path) {
+        const access = this.environment.getAccessService();
+        try {
+            await access.createAccess({
+                name,
+                path
+            });
+        }
+        catch (e) {
+            // 当 Path 存在时，校验 Path 绑定的函数是不是当前函数
+            if (e.code === 'InvalidParameter.APICreated') {
+                const { APISet } = await access.getAccessList({
+                    name
+                });
+                if ((APISet === null || APISet === void 0 ? void 0 : APISet[0].Name) !== name || (APISet === null || APISet === void 0 ? void 0 : APISet[0].Type) !== 1) {
+                    throw e;
+                }
+            }
+            else {
+                throw e;
+            }
+        }
+    }
     // 获取 COS 临时信息
     async getTempCosInfo(name) {
         const { env, appId } = await this.getFunctionConfig();
@@ -1755,6 +1811,9 @@ __decorate([
 __decorate([
     (0, utils_1.preLazy)()
 ], FunctionService.prototype, "updateFunctionCode", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], FunctionService.prototype, "updateFunctionWithProgress", null);
 __decorate([
     (0, utils_1.preLazy)()
 ], FunctionService.prototype, "invokeFunction", null);
@@ -1829,10 +1888,10 @@ __decorate([
 ], FunctionService.prototype, "uploadFunctionZipToCos", null);
 __decorate([
     (0, utils_1.preLazy)()
-], FunctionService.prototype, "createAccessPath", null);
+], FunctionService.prototype, "getCodeParams", null);
 __decorate([
     (0, utils_1.preLazy)()
-], FunctionService.prototype, "getCodeParams", null);
+], FunctionService.prototype, "createAccessPath", null);
 __decorate([
     (0, utils_1.preLazy)()
 ], FunctionService.prototype, "getTempCosInfo", null);

package/lib/index.js

@@ -79,12 +79,18 @@ class CloudBase {
     get env() {
         return this.currentEnvironment().getEnvService();
     }
+    get log() {
+        return this.currentEnvironment().getLogService();
+    }
     get third() {
         return this.currentEnvironment().getThirdService();
     }
     get user() {
         return this.currentEnvironment().getUserService();
     }
+    get permission() {
+        return this.currentEnvironment().getPermissionService();
+    }
     get docs() {
         if (!this.docsService) {
             this.docsService = new docs_1.DocsService();

package/lib/log/index.js

@@ -0,0 +1,105 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LogService = void 0;
+exports.isLogServiceEnabled = isLogServiceEnabled;
+const utils_1 = require("../utils");
+__exportStar(require("./types"), exports);
+/**
+ * 纯函数：根据 DescribeEnvs 返回的 LogServices 列表判断日志服务是否已开通。
+ * 已开通条件：至少一个条目有有效的 TopicId。
+ */
+function isLogServiceEnabled(logServices) {
+    if (!logServices || logServices.length === 0)
+        return false;
+    return logServices.some(svc => !!svc.TopicId);
+}
+class LogService {
+    constructor(environment) {
+        this.envId = environment.getEnvId();
+        this.cloudService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
+        this.tcbrService = new utils_1.CloudService(environment.cloudBaseContext, 'tcbr', '2022-02-17');
+    }
+    /**
+     * 检查当前环境的日志服务是否已开通
+     *
+     * 通过 DescribeEnvs 接口获取环境信息，判断 LogServices 字段中是否包含有效的
+     * 日志主题（TopicId 不为空）。
+     *
+     * @returns true 表示已开通，false 表示未开通或开通中
+     */
+    async checkLogServiceEnabled() {
+        var _a;
+        const res = await this.cloudService.request('DescribeEnvs', {
+            EnvId: this.envId
+        });
+        const envInfo = (_a = res === null || res === void 0 ? void 0 : res.EnvList) === null || _a === void 0 ? void 0 : _a[0];
+        if (!envInfo) {
+            return false;
+        }
+        const logServices = envInfo.LogServices;
+        if (!logServices || logServices.length === 0) {
+            return false;
+        }
+        // 已开通：LogServiceInfo 中存在有效的日志主题 ID
+        return isLogServiceEnabled(logServices);
+    }
+    /**
+     * 开通环境日志服务（异步操作）
+     *
+     * 调用 CreateEnvResource 接口开通日志资源。
+     * 注意：接口调用成功不代表日志资源立即可用，需通过 checkLogServiceEnabled() 轮询确认。
+     *
+     * @returns 请求 ID
+     */
+    async createLogService() {
+        return this.cloudService.request('CreateEnvResource', {
+            EnvId: this.envId,
+            Resources: ['log']
+        });
+    }
+    /**
+     * 搜索 CLS 日志
+     *
+     * @param params 查询参数，通过 queryString 使用 CLS 原生检索分析语法
+     * @returns 日志搜索结果
+     *
+     * @remarks
+     * - 纯检索结果在 `LogResults.Results` 中
+     * - SQL 分析结果（queryString 含 `| select ...`）在 `LogResults.AnalysisRecords` 中
+     * - 详细的 QueryString 语法参考见 README.md
+     */
+    async searchClsLog(params) {
+        const { queryString, StartTime, EndTime, Limit, Context, Sort, UseLucene, service } = params;
+        const requestService = service === 'tcbr' ? this.tcbrService : this.cloudService;
+        const requestParams = {
+            EnvId: this.envId,
+            StartTime,
+            EndTime,
+            QueryString: queryString,
+            Limit,
+            Context,
+            Sort,
+            UseLucene
+        };
+        // TenantModel 仅 tcb 服务需要，tcbr 不支持该参数
+        if (service !== 'tcbr') {
+            requestParams.TenantModel = 'public';
+        }
+        return requestService.request('SearchClsLog', requestParams);
+    }
+}
+exports.LogService = LogService;

package/lib/log/types.js

@@ -0,0 +1,24 @@
+"use strict";
+// =====================================================
+// CLS 日志字段枚举 & Module 查询 Schema
+// =====================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLS_MODULE_SCHEMA = void 0;
+// =====================================================
+// CLS Module 运行时常量
+// =====================================================
+/**
+ * ClsModuleSchema 的运行时版本，用于动态生成查询条件 / MCP tool description
+ *
+ * - key 与 ClsLogModule 类型保持同步
+ * - eventTypes / logTypes 为字符串数组，空数组表示该维度不可过滤
+ */
+exports.CLS_MODULE_SCHEMA = {
+    database: { label: '云数据库(文档型)', eventTypes: ['MongoSlowQuery'], logTypes: [] },
+    rdb: { label: '云数据库(SQL型)', eventTypes: ['MysqlFreeze', 'MysqlRecover', 'MysqlSlowQuery'], logTypes: [] },
+    model: { label: '数据模型', eventTypes: [], logTypes: [] },
+    workflow: { label: '审批流', eventTypes: [], logTypes: [] },
+    auth: { label: '用户权限', eventTypes: [], logTypes: [] },
+    llm: { label: '大模型', eventTypes: [], logTypes: ['llm-tracelog'] },
+    app: { label: '应用', eventTypes: ['AppProdPub', 'AppProdDel'], logTypes: [] },
+};

package/lib/permission/index.js

@@ -0,0 +1,313 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionService = void 0;
+const utils_1 = require("../utils");
+const PERMISSION_BY_RESOURCE = {
+    function: ['CUSTOM'],
+    storage: ['READONLY', 'PRIVATE', 'ADMINWRITE', 'ADMINONLY', 'CUSTOM'],
+    table: ['READONLY', 'PRIVATE', 'ADMINWRITE', 'ADMINONLY'],
+    collection: ['READONLY', 'PRIVATE', 'ADMINWRITE', 'ADMINONLY', 'CUSTOM']
+};
+class PermissionService {
+    constructor(environment) {
+        this.environment = environment;
+        this.tcbService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
+    }
+    async modifyResourcePermission(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { resourceType, resource, permission, securityRule } = options;
+        if (!resourceType || !PERMISSION_BY_RESOURCE[resourceType]) {
+            throw new Error('Invalid resourceType');
+        }
+        if (typeof resource !== 'string' || resource.trim().length === 0) {
+            throw new Error('Invalid resource');
+        }
+        const allowed = PERMISSION_BY_RESOURCE[resourceType];
+        if (!allowed.includes(permission)) {
+            throw new Error(`Permission ${permission} is not allowed for resourceType ${resourceType}`);
+        }
+        if (permission === 'CUSTOM') {
+            if (typeof securityRule !== 'string' || securityRule.trim().length === 0) {
+                throw new Error('securityRule is required when permission is CUSTOM');
+            }
+            // // 校验 JSON 字符串合法性
+            // try {
+            //     JSON.parse(securityRule)
+            // } catch {
+            //     throw new Error('securityRule must be a valid JSON string')
+            // }
+        }
+        const reqData = {
+            EnvId,
+            ResourceType: resourceType,
+            Resource: resource,
+            Permission: permission
+        };
+        if (permission === 'CUSTOM') {
+            reqData.SecurityRule = securityRule;
+        }
+        return this.tcbService.request('ModifyResourcePermission', reqData);
+    }
+    async describeResourcePermission(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { resourceType, resources } = options;
+        if (!resourceType || !PERMISSION_BY_RESOURCE[resourceType]) {
+            throw new Error('Invalid resourceType');
+        }
+        if (resources !== undefined) {
+            if (!Array.isArray(resources)) {
+                throw new Error('Invalid resources');
+            }
+            if (resources.length > 100) {
+                throw new Error('resources length must be <= 100');
+            }
+            const invalid = resources.find(item => typeof item !== 'string' || item.trim().length === 0);
+            if (invalid !== undefined) {
+                throw new Error('resources contains invalid item');
+            }
+        }
+        return this.tcbService.request('DescribeResourcePermission', Object.assign({ EnvId, ResourceType: resourceType }, (resources !== undefined ? { Resources: resources } : {})));
+    }
+    async createRole(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { roleName, roleIdentity, description, memberUids, policies } = options;
+        // RoleName 校验：非空，2-32字符，中文/字母/数字/_-:@.，必须以字母或中文开头
+        if (typeof roleName !== 'string' || roleName.trim().length === 0) {
+            throw new Error('roleName is required');
+        }
+        if (roleName.length < 2 || roleName.length > 32) {
+            throw new Error('roleName length must be between 2 and 32');
+        }
+        if (!/^[\u4e00-\u9fa5a-zA-Z]/.test(roleName)) {
+            throw new Error('roleName must start with a letter or Chinese character');
+        }
+        if (!/^[\u4e00-\u9fa5a-zA-Z0-9\-_:@.]+$/.test(roleName)) {
+            throw new Error('roleName can only contain Chinese, letters, digits, and -_:@.');
+        }
+        // RoleIdentity 校验：非空，字母/数字/_-:@.，不能与默认角色标识重复
+        if (typeof roleIdentity !== 'string' || roleIdentity.trim().length === 0) {
+            throw new Error('roleIdentity is required');
+        }
+        if (!/^[a-zA-Z0-9\-_:@.]+$/.test(roleIdentity)) {
+            throw new Error('roleIdentity can only contain letters, digits, and -_:@.');
+        }
+        // Description 校验
+        if (description !== undefined && description.length > 255) {
+            throw new Error('description length must be <= 255');
+        }
+        // MemberUids 校验
+        if (memberUids !== undefined) {
+            if (!Array.isArray(memberUids)) {
+                throw new Error('memberUids must be an array');
+            }
+            if (memberUids.length > 100) {
+                throw new Error('memberUids length must be <= 100');
+            }
+            const invalidUid = memberUids.find(uid => typeof uid !== 'string' || uid.trim().length === 0);
+            if (invalidUid !== undefined) {
+                throw new Error('memberUids contains invalid item');
+            }
+        }
+        // Policies 校验
+        if (policies !== undefined) {
+            if (!Array.isArray(policies)) {
+                throw new Error('policies must be an array');
+            }
+            if (policies.length > 50) {
+                throw new Error('policies length must be <= 50');
+            }
+            const invalidPolicy = policies.find(policy => !policy.ResourceType || !policy.Resource);
+            if (invalidPolicy !== undefined) {
+                throw new Error('each policy must have ResourceType and Resource');
+            }
+        }
+        const reqData = {
+            EnvId,
+            RoleName: roleName,
+            RoleIdentity: roleIdentity
+        };
+        if (description !== undefined) {
+            reqData.Description = description;
+        }
+        if (memberUids !== undefined && memberUids.length > 0) {
+            reqData.MemberUids = memberUids;
+        }
+        if (policies !== undefined && policies.length > 0) {
+            reqData.Policies = policies;
+        }
+        return this.tcbService.request('CreateRole', reqData);
+    }
+    async describeRoleList(options = {}) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { pageNumber, pageSize, roleId, roleIdentity, roleName, loadDetails } = options;
+        // PageNumber 校验：从1开始
+        if (pageNumber !== undefined && (pageNumber < 1 || !Number.isInteger(pageNumber))) {
+            throw new Error('pageNumber must be a positive integer');
+        }
+        // PageSize 校验：默认10，最大100
+        if (pageSize !== undefined && (pageSize < 1 || pageSize > 100 || !Number.isInteger(pageSize))) {
+            throw new Error('pageSize must be an integer between 1 and 100');
+        }
+        // RoleId 校验
+        if (roleId !== undefined && (typeof roleId !== 'string' || roleId.trim().length === 0)) {
+            throw new Error('Invalid roleId');
+        }
+        // RoleIdentity 校验
+        if (roleIdentity !== undefined && (typeof roleIdentity !== 'string' || roleIdentity.trim().length === 0)) {
+            throw new Error('Invalid roleIdentity');
+        }
+        // RoleName 校验
+        if (roleName !== undefined && (typeof roleName !== 'string' || roleName.trim().length === 0)) {
+            throw new Error('Invalid roleName');
+        }
+        const reqData = { EnvId };
+        if (pageNumber !== undefined) {
+            reqData.PageNumber = pageNumber;
+        }
+        if (pageSize !== undefined) {
+            reqData.PageSize = pageSize;
+        }
+        if (roleId !== undefined) {
+            reqData.RoleId = roleId;
+        }
+        if (roleIdentity !== undefined) {
+            reqData.RoleIdentity = roleIdentity;
+        }
+        if (roleName !== undefined) {
+            reqData.RoleName = roleName;
+        }
+        if (loadDetails !== undefined) {
+            reqData.LoadDetails = loadDetails;
+        }
+        return this.tcbService.request('DescribeRoleList', reqData);
+    }
+    async modifyRole(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { roleId, roleName, description, addMemberUids, removeMemberUids, addPolicies, removePolicies } = options;
+        // RoleId 校验：必填
+        if (typeof roleId !== 'string' || roleId.trim().length === 0) {
+            throw new Error('roleId is required');
+        }
+        // RoleName 校验：不传或传空 => 不修改；非空时校验规则
+        if (roleName !== undefined && roleName !== '') {
+            if (roleName.length < 2 || roleName.length > 32) {
+                throw new Error('roleName length must be between 2 and 32');
+            }
+            if (!/^[\u4e00-\u9fa5a-zA-Z]/.test(roleName)) {
+                throw new Error('roleName must start with a letter or Chinese character');
+            }
+            if (!/^[\u4e00-\u9fa5a-zA-Z0-9\-_:@.]+$/.test(roleName)) {
+                throw new Error('roleName can only contain Chinese, letters, digits, and -_:@.');
+            }
+        }
+        // Description 校验
+        if (description !== undefined && description.length > 255) {
+            throw new Error('description length must be <= 255');
+        }
+        // AddMemberUids 校验
+        if (addMemberUids !== undefined) {
+            if (!Array.isArray(addMemberUids)) {
+                throw new Error('addMemberUids must be an array');
+            }
+            const invalidUid = addMemberUids.find(uid => typeof uid !== 'string' || uid.trim().length === 0);
+            if (invalidUid !== undefined) {
+                throw new Error('addMemberUids contains invalid item');
+            }
+        }
+        // RemoveMemberUids 校验
+        if (removeMemberUids !== undefined) {
+            if (!Array.isArray(removeMemberUids)) {
+                throw new Error('removeMemberUids must be an array');
+            }
+            const invalidUid = removeMemberUids.find(uid => typeof uid !== 'string' || uid.trim().length === 0);
+            if (invalidUid !== undefined) {
+                throw new Error('removeMemberUids contains invalid item');
+            }
+        }
+        // AddPolicies 校验
+        if (addPolicies !== undefined) {
+            if (!Array.isArray(addPolicies)) {
+                throw new Error('addPolicies must be an array');
+            }
+            const invalidPolicy = addPolicies.find(policy => !policy.ResourceType || !policy.Resource);
+            if (invalidPolicy !== undefined) {
+                throw new Error('each addPolicy must have ResourceType and Resource');
+            }
+        }
+        // RemovePolicies 校验
+        if (removePolicies !== undefined) {
+            if (!Array.isArray(removePolicies)) {
+                throw new Error('removePolicies must be an array');
+            }
+            const invalidPolicy = removePolicies.find(policy => !policy.ResourceType || !policy.Resource);
+            if (invalidPolicy !== undefined) {
+                throw new Error('each removePolicy must have ResourceType and Resource');
+            }
+        }
+        const reqData = { EnvId, RoleId: roleId };
+        // RoleName：不传或传空 => 不修改（不下发）
+        if (roleName !== undefined && roleName !== '') {
+            reqData.RoleName = roleName;
+        }
+        if (description !== undefined) {
+            reqData.Description = description;
+        }
+        if (addMemberUids !== undefined) {
+            reqData.AddMemberUids = addMemberUids;
+        }
+        if (removeMemberUids !== undefined) {
+            reqData.RemoveMemberUids = removeMemberUids;
+        }
+        if (addPolicies !== undefined) {
+            reqData.AddPolicies = addPolicies;
+        }
+        if (removePolicies !== undefined) {
+            reqData.RemovePolicies = removePolicies;
+        }
+        return this.tcbService.request('ModifyRole', reqData);
+    }
+    async deleteRoles(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { roleIds } = options;
+        // RoleIds 校验：必填数组，最多100个
+        if (!Array.isArray(roleIds) || roleIds.length === 0) {
+            throw new Error('roleIds is required and must be a non-empty array');
+        }
+        if (roleIds.length > 100) {
+            throw new Error('roleIds length must be <= 100');
+        }
+        const invalidId = roleIds.find(id => typeof id !== 'string' || id.trim().length === 0);
+        if (invalidId !== undefined) {
+            throw new Error('roleIds contains invalid item');
+        }
+        return this.tcbService.request('DeleteRoles', {
+            EnvId,
+            RoleIds: roleIds
+        });
+    }
+}
+exports.PermissionService = PermissionService;
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "modifyResourcePermission", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "describeResourcePermission", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "createRole", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "describeRoleList", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "modifyRole", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "deleteRoles", null);

package/lib/permission/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cloudbase/manager-node",
-    "version": "4.11.0-alpha.6",
+    "version": "4.11.0-alpha.8",
     "description": "The node manage service api for cloudbase.",
     "main": "lib/index.js",
     "scripts": {